Any subsequent PR reviews after the first required approval will trigger handle.yml

### TL;DR

Since we only check the reviewDecision on a pull request, when it is firstly approved by code owner/required approvers, it will stay approved, thus that any subsequence reviews can successfully trigger handle which is a risk.

Fix: add a condition description to lock the IAM binding change.

Since the first handle is always legitimate and repo setting always dismiss approvals when commits are pushed, we will tag the IAM binding with the latest commit, any subsequent reviews will be discarded if the latest the commit is already handled.

### Expected behavior

_No response_

### Observed behavior

_No response_

### Environment Details

```markdown
n/a
```

### Additional information

_No response_